GKE fluentbit with workload identity

gke-fluentbit-workload-identity.sh

region=us-east1
zone=${region}-b
project_id=[YOUR_PROJECT_ID]

gcloud config set compute/zone ${zone}
gcloud config set project ${project_id}

gcloud container clusters create custom-fluentbit \
  --zone $zone \
  --logging=SYSTEM \
  --tags=gke-cluster-with-customized-fluentbit \
  --workload-pool=${project_id}.svc.id.goog

gcloud iam service-accounts create fluent-bit-sa

gcloud projects add-iam-policy-binding ${project_id} \
  --member "serviceAccount:fluent-bit-sa@${project_id}.iam.gserviceaccount.com" \
  --role "roles/logging.logWriter"

gcloud iam service-accounts add-iam-policy-binding \
 --role roles/iam.workloadIdentityUser \
 --member "serviceAccount:${project_id}.svc.id.goog[logging/fluent-bit]" \
 fluent-bit-sa@${project_id}.iam.gserviceaccount.com

kubectl apply -f kubernetes/test-logger.yaml
kubectl apply -f ./kubernetes/fluentbit-rbac.yaml
kubectl apply -f kubernetes/fluentbit-configmap.yaml

kubectl annotate serviceaccount \
  --namespace logging fluent-bit \
  iam.gke.io/gcp-service-account=fluent-bit-sa@${project_id}.iam.gserviceaccount.com

kubectl apply -f kubernetes/fluentbit-daemonset.yaml